flow-batch-operator-slashing: stop cranking chkdispute from the harness - #81
Conversation
The dispute step called `sysio.chalg::chkdispute` itself inside the resolution poll, so the flow resolved its own dispute and passed whether or not anything in production would. That is the one thing this flow cannot self-supply: nothing in the tree cranked `chkdispute`, and for a dispute the difference is "the epoch resumes" vs "the epoch stays paused with quorum already reached". Drop `crankChkdispute` and its call site. The poll now waits for the production crank (wire-sysio `batch_operator_plugin::crank_open_disputes`), so a timeout here means nothing tallied the votes — which is exactly the assertion worth having. The three `dispop.*` are SBP-less, but the bootstrapped batch operators keep their daemons and stay opreg-ACTIVE across the dispute (bootstrapped ops bypass `termcheck`, and a paused epoch runs no `recorddel`), so their plugin tick is what resolves it. `crankChkcons` is unchanged — the SBP-less group genuinely has nothing to drive `chkcons`, and that is scenario setup rather than a production behavior. REQUIRES wire-sysio#582. Do not merge this before that lands: without the plugin crank the dispute never resolves and this flow times out. Change-Id: Ic83621495c52ea432bca8b617a2f47a6a61b14f3
8e366a6 to
68b7196
Compare
e2e gate: GREEN — and it proves the crank exists in productionRun 32518249867 · Release · 19:23:48 → 20:13:11 UTC (49 min) ·
Why this is the proof, not just a green tick
It also settles the open assumption in #81: the bootstrapped batch operators do keep their daemons and stay opreg-ACTIVE across the paused epoch, and their tick reaches the dispute even though Durations line up with the known-good baselineAgainst run Also verified
Merge orderWire-Network/wire-sysio#582 first, then #81. Reversed, the flow has no crank and times out. |
What this fixes
The dispute step called
sysio.chalg::chkdisputeitself, inside the resolution poll:So the flow resolved its own dispute and passed whether or not anything in production would. That is exactly what it could not self-supply: nothing in the tree cranked
chkdispute(0 references underplugins/), and for a dispute the difference is "the epoch resumes" vs "the epoch stays paused with quorum already reached". The flow was green throughout.The change
Delete
crankChkdisputeand its call site. The poll now waits for the production crank — wire-sysiobatch_operator_plugin::crank_open_disputes— so a timeout here means nothing tallied the votes, which is the assertion worth having.Why this flow can still prove it
The three
dispop.*are provisioned SBP-less (no daemon) — that is how the 3-way split is forced, and it is whycrankChkconsstays: that group genuinely has nothing to drivechkcons, and supplying it is scenario setup, not a stand-in for production behavior.The bootstrapped batch operators are what make the proof work. They keep their daemons, and they stay opreg-ACTIVE across the dispute — bootstrapped ops bypass
termcheck, and a paused epoch runs norecorddel. They fall outside the group after theschbatchgpshand-off, which is exactly why the plugin crank is gated onis_activerather thanis_elected. Their tick is what resolves the dispute here.This is the assumption the A/B run validates. If the flow times out at the resolution step with wire-sysio#582 in, the bootstrapped daemons are not cranking and the gating needs another look.
Verification
pnpm buildcleanpnpm run lintcleanpnpm test— 1954/1956. The 2 failures areClusterBuildDefaultsExternal.test.ts(ENOENT … bind-registry/wire-cluster-ports.lock.lock), confirmed pre-existing: identical failures with this change stashed on the same worktree. Unrelated/tmplock race; this diff touches onlyflow-batch-operator-slashing, which has no jest.@wireio/sdk-core→../wire-libraries-ts/packages/sdk-core,@wireio/opp-typescript-models→../wire-sysio/build/opp/typescript).